OLLVM Deobfuscation Rule in reverse-skill: Routing Matrix and Implementation

The OLLVM deobfuscation rule is defined in skills/routing.md under both "By Target Type" and "By User Intent" sections, routing matching requests to skills/reverse-engineering/references/ollvm-deobfuscation.md for complete workflow instructions.

The reverse-skill repository employs a routing matrix to map specific user intents and binary characteristics to appropriate skills and reference documents. For OLLVM deobfuscation tasks, the project implements dedicated matching rules that handle control flow flattening, bogus control flow, and MBA obfuscation techniques. These rules direct the automation scripts to the specialized reference documentation containing tool recommendations and step-by-step procedures.

Rule Definition in skills/routing.md

The central routing configuration defines two distinct trigger patterns that identify OLLVM-related deobfuscation tasks.

Target Type Classification

The matrix matches OLLVM-obfuscated binaries using the rule: "OLLVM‑obfuscated binary (控制流平坦化/虚假控制流/MBA)". This pattern identifies binaries exhibiting control flow flattening, bogus control flow, or Mixed Boolean-Arithmetic operations regardless of the specific compiler variant used.

User Intent Matching

For explicit deobfuscation requests, the rule triggers on: "OLLVM deobfuscate / 控制流平坦化去除 / deflat / 脱混淆". This multilingual pattern covers English terminology, Chinese descriptions, and the specific "deflat" keyword popularized by community deobfuscation tools.

Both routing rules resolve to the same destination file: skills/reverse-engineering/references/ollvm-deobfuscation.md.

Routing Execution Workflow

The rule application follows a structured behavior chain enforced by RULES.md and implemented through the master router scripts.

Primary Router Scripts

The skills/scripts/master-route.sh (Bash) or skills/scripts/master-route.ps1 (PowerShell) serves as the entry point. These scripts first consult skills/config/routing.json for initial skill classification, then apply the advisory matrix from skills/routing.md to resolve specific intents.

Rule Application Process

1. The router receives a hint via the --hint (Bash) or -Hint (PowerShell) parameter.

2. It compares the input against the routing matrix entries documented in skills/routing.md.

3. Upon matching the OLLVM deobfuscation rule, the router opens the reference file skills/reverse-engineering/references/ollvm-deobfuscation.md.

Trigger the routing with:

bash skills/scripts/master-route.sh --hint "OLLVM deobfuscate"

In Windows environments:

powershell -File skills/scripts/master-route.ps1 -Hint "OLLVM deobfuscate"

Reference Document Access

Once routed, the workflow proceeds according to the instructions in the reference file. A typical subsequent step involves launching recommended tools such as d810-ng:

/path/to/d810-ng --input sample.elf --output deobf_sample.elf

Core Files in the OLLVM Routing System

• skills/routing.md: Central routing matrix containing the OLLVM deobfuscation rules and intent mappings.

• skills/reverse-engineering/references/ollvm-deobfuscation.md: Detailed reference documentation containing the complete deobfuscation workflow, tool configurations, and variant-specific handling instructions.

• RULES.md: Behavior-chain enforcement file ensuring the routing matrix is consulted during skill resolution.

• skills/scripts/master-route.sh and skills/scripts/master-route.ps1: Cross-platform router implementations that execute the rule matching logic.

• skills/config/routing.json: Initial configuration file used by the router scripts for primary skill selection.

Summary

• The OLLVM deobfuscation rule resides in skills/routing.md with dual trigger patterns covering both automatic binary type detection and explicit user intent specifications.

• The control flow flattening (控制流平坦化), bogus control flow (虚假控制流), and MBA patterns are explicitly supported in the target type classification.

• Router scripts implement this rule by consulting skills/config/routing.json followed by the advisory matrix in skills/routing.md.

• Successful rule matches direct the workflow to skills/reverse-engineering/references/ollvm-deobfuscation.md according to the behavior chain defined in RULES.md.

Frequently Asked Questions

What is the exact wording of the OLLVM deobfuscation rule in reverse-skill?

The rule appears in two forms within skills/routing.md: "OLLVM‑obfuscated binary (控制流平坦化/虚假控制流/MBA)" for binary type classification, and "OLLVM deobfuscate / 控制流平坦化去除 / deflat / 脱混淆" for explicit user requests. Both patterns route to the same reference documentation.

Which script executes the OLLVM deobfuscation routing decision?

The skills/scripts/master-route.sh (Linux/macOS) or skills/scripts/master-route.ps1 (Windows) scripts handle the routing execution. These scripts parse the routing configuration and apply the matrix rules to resolve OLLVM-related hints to the appropriate reference files.

Where can I find the detailed OLLVM deobfuscation workflow?

The complete workflow, including tool recommendations like d810-ng and variant-specific handling instructions, is documented in skills/reverse-engineering/references/ollvm-deobfuscation.md. This file is opened automatically when the routing rule matches an OLLVM deobfuscation request.

Does the reverse-skill routing rule support multiple OLLVM variants?

Yes. The target type rule explicitly supports multiple obfuscation techniques including control flow flattening (控制流扁平化), bogus control flow (虚假控制流), and MBA (Mixed Boolean-Arithmetic) expressions, covering the majority of OLLVM and ollvm-vs variants encountered in production binaries.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}